forked from cloudposse/terraform-aws-cloudtrail-s3-bucket
-
Notifications
You must be signed in to change notification settings - Fork 0
/
main.tf
121 lines (100 loc) · 4.26 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
module "access_log_label" {
source = "cloudposse/label/null"
version = "0.24.1"
name = "cloudtrail-access-log"
context = module.this.context
}
module "s3_bucket" {
source = "cloudposse/s3-log-storage/aws"
version = "0.18.0"
enabled = module.this.enabled
acl = var.acl
policy = join("", data.aws_iam_policy_document.default.*.json)
force_destroy = var.force_destroy
versioning_enabled = var.versioning_enabled
lifecycle_rule_enabled = var.lifecycle_rule_enabled
lifecycle_prefix = var.lifecycle_prefix
lifecycle_tags = var.lifecycle_tags
noncurrent_version_expiration_days = var.noncurrent_version_expiration_days
noncurrent_version_transition_days = var.noncurrent_version_transition_days
standard_transition_days = var.standard_transition_days
glacier_transition_days = var.glacier_transition_days
enable_glacier_transition = var.enable_glacier_transition
expiration_days = var.expiration_days
abort_incomplete_multipart_upload_days = var.abort_incomplete_multipart_upload_days
sse_algorithm = var.sse_algorithm
kms_master_key_arn = var.kms_master_key_arn
block_public_acls = var.block_public_acls
block_public_policy = var.block_public_policy
ignore_public_acls = var.ignore_public_acls
restrict_public_buckets = var.restrict_public_buckets
access_log_bucket_name = local.access_log_bucket_name
context = module.this.context
}
module "s3_access_log_bucket" {
source = "cloudposse/s3-log-storage/aws"
version = "0.18.0"
enabled = module.this.enabled && var.create_access_log_bucket
acl = var.acl
policy = ""
force_destroy = var.force_destroy
versioning_enabled = var.versioning_enabled
lifecycle_rule_enabled = var.lifecycle_rule_enabled
lifecycle_prefix = var.lifecycle_prefix
lifecycle_tags = var.lifecycle_tags
noncurrent_version_expiration_days = var.noncurrent_version_expiration_days
noncurrent_version_transition_days = var.noncurrent_version_transition_days
standard_transition_days = var.standard_transition_days
glacier_transition_days = var.glacier_transition_days
enable_glacier_transition = var.enable_glacier_transition
expiration_days = var.expiration_days
abort_incomplete_multipart_upload_days = var.abort_incomplete_multipart_upload_days
sse_algorithm = var.sse_algorithm
kms_master_key_arn = var.kms_master_key_arn
block_public_acls = var.block_public_acls
block_public_policy = var.block_public_policy
ignore_public_acls = var.ignore_public_acls
restrict_public_buckets = var.restrict_public_buckets
access_log_bucket_name = ""
attributes = ["access-logs"]
context = module.this.context
}
data "aws_iam_policy_document" "default" {
count = module.this.enabled ? 1 : 0
statement {
sid = "AWSCloudTrailAclCheck"
principals {
type = "Service"
identifiers = ["cloudtrail.amazonaws.com"]
}
actions = [
"s3:GetBucketAcl",
]
resources = [
"${var.arn_format}:s3:::${module.this.id}",
]
}
statement {
sid = "AWSCloudTrailWrite"
principals {
type = "Service"
identifiers = ["config.amazonaws.com", "cloudtrail.amazonaws.com"]
}
actions = [
"s3:PutObject",
]
resources = [
"${var.arn_format}:s3:::${module.this.id}/*",
]
condition {
test = "StringEquals"
variable = "s3:x-amz-acl"
values = [
"bucket-owner-full-control",
]
}
}
}
locals {
access_log_bucket_name = var.create_access_log_bucket == true ? module.s3_access_log_bucket.bucket_id : var.access_log_bucket_name
}